1.
ISIS’
leaderless
revolution
& the Sri
Lanka
attacks
by
MeiLee Dozier & Jeff M. Moore, PhD
for the
Westminster Institute
26 June 2019
1
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

2.
Agenda*
 Check the map
 Summary of attack
 Indications & warnings
 The culprits
 The bombs
 The church attacks
 The hotel attacks
 Three more bombs
 Aftermath
 Conclusions
*Situation out of the critical stage, but still developing. Investigations ongoing, data
points & subsequent analyses subject to change.
2
*OSINT (w/observed analyses on ground)
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

3.
Check the map
3
Sainthamaruthu
Panadura
Kattankudy
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

4.
Summary of the attack
Spectacular, highly synchronized, multi-stage, high-payoff; greater Colombo metro area & Batticaloa.
4
Phase 1: 21 Apr 2019 Phase 2: w/in 90 min Phase 3: 26 Apr 2019
 8 suicide bombers
 3 churches
 St. Anthony’s (1 IED)
 St. Sebastian’s (1
IED)
 Zion Church (1 IED;
initial targ)
 4 hotels (restaurants -1)
 Kingsbury (1 IED)
 Shangri-La (2 IEDs)
 Cinnamon Grand (1
IED)
 New Tropical Inn (1
IED; initial targ = Taj
Samudra, 2 IEDs?)
@ least 12 operatives @ least 14-16 IEDs @ 11 targs, 9 successful
Casualties: 258 KIA, 500 WIA NTJ-JMI/ISIS franchise
 3 follow on bombings
 1 VBIED (1-3
devices)
 1 roadside IED @
airport
 Lure bombing or
“come on”: raid on
key bomber’s house
by STF, wife kills self,
unborn child, 3
children, 3 police
 Terror cell’s last stand
 Ambush: firefight
w/STF, then 3
suicide bombs
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

5.
 Buddhist-Muslim strife.
 3 Mar 2018, Kandy, Buddhist man beaten by Muslim youth after traffic dispute,
= 5 days of religious violence, 2 KIA, 20 mosques/224 houses/119 businesses
damaged or destroyed.​
 26 Dec 2018, young men on motorcycles desecrated Buddha statues
around Mawanella.
5
Indicators & warnings
 2013 - 21 Apr 2019* (scores of issues/indicators/warnings before 2013).
1. Multiple Muslim-Buddhist strife (@ least 5 major instances).
2. Multiple IJ vs. Sufi/mod Muslim clashes (@ least 5 major instances, prior 2013).*
3. Moderate & Sufi Muslims informing on IJ directly to the SL gov (@ least 5 major
instances).
4. SL &/or foreign gov threat warnings/indicators (@ least 8 major instances).
1
 IJ vs. Sufi/moderate Muslims.
 10 Mar 2017 “Aliyar junction clash”, Hashim & followers met for debate w/Sufis,
showed up armed/primed for violence, Muslims shocked, angry @ Hashim.
 2006, multiple attacks on Sufi mosques.
2
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

6.
6
Indicators & warnings
 Direct threat warnings on this very attack.
 4, 9, 11, and 21 April (day of).
 Incl lists of suspects.
 Incl churches as targets.
 Mar 2018, after Kandy riots Hashim released a video.
 Called for killing of non-Muslims in Sri Lanka.
 Police officers should be attacked.
 Bombs should be set off all over the country.
 Muslim leaders handed over the video to Sri Lankan police.​
 Various occasion, Muslim Council of Sri Lanka.
 Warned gov of Hashim, provided CDs/propaganda material
 3 Jan 2019, All Ceylon Jamiaythul Ulema (ACJU – umbrella org of all Muslims,
criticize Sufis).
 Complained to MoD about the activities of NTJ.
 Provided list of suspects & activities.
3
4
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

7.
 National Thowfeek Jamaath (Thawheed
Jama’ut, NTJ)
 “National ‘One Religion/One God’ Organization.”
 Origins in S Indian state Tamil Nadu, early 2000s.
 Protested “social evils”, rumored $ from ME.
 Hashim founded NTJ in SL in 2012 (est).
 Hashim “kicked out of NTJ” in 2017 (possibly
D&D to protect JMT post bombing).
 Jammiyathul Millathu Ibrahim (JMI)
 “Organization of the Way of Abraham.”
 Seemed to have joined w/NTJ.
 Leadership
 Mohammed Cassim Mohamed
Zaharan (Hashim).
 Born ‘86, radical as a teen.
 Sister: “…He started to preach against
the government, the national flag,
against elections, & against other
religions. He brought catastrophe
upon our family.”
 Assembled like minded group,
convinced Sufis to convert to IJ.
 Conspired to live up to his preaching.
The culprits
7
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

8.
“…the savagery, brutality & ill
intentions of the Christians
towards the Muslim
community.”
 ISIS
 Leaderless revolution strategy: co-opting individuals
& groups electronically & dahwah.
 Train, plan, execute operations on their own.
 29 April, Abu Bakr al-Baghdadi video, 1st
time in 5
yrs, Sri Lanka was ISIS op for losing caliphate.
 Al-Baghdadi’s vid featured Easter bombers’ video
pledging to ISIS.
The culprits
“…Our battle today is one of attrition,” &
“God ordered us to wage jihad & did not
order us to achieve victory.”
“…The only effective method against those
tawaghit (taghut) is al-sayf. They need to
return to the Almighty & Exalted God.”
“This, by God’s permission, is only part of the
vengeance that is awaiting the crusaders &
their quislings. All praise is due to God, for
among those killed were some Americans &
Europeans.”
“As for you brothers in Sri Lanka, they have pleased &
healed the muwahideen’s chests with their inghimasi
operations that unsettled the crusaders in their Easter
celebration to avenge their brothers in Baghuz.”
1
2
3
4
8
5
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

9.
 @ least 1 yr testing: bomb factories,
timing devices, tested on motorcycles.
 Manufactured by local IJ “w/ISIS
expertise” – possibly done w/out ISIS
 Container = gray backpack, 30-40
liters.
 Explosive compound = TATP + possibly
watergel, or gelignite, or ANFO.
 Shrapnel: nails & ball bearings.
 Trigger/switch = pull strap on
backpack.
 Detonator/initiator = lightbulb
filament.
The bombs
NTJ weapons cache, 182 sticks of watergel (est)
9
triacetone triperoxide
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

10.
St Sebastian’s
The bombs
St Anthony’s
Zion Church
10
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

11.
The bombs
The Kingsbury
The Shangri-La
The Cinnamon Grand
11
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

12.
The church attacks
12
 St. Anthony’s Shrine, Colombo​​
 Famous historic church, attended
by VIPs, politicians, commemorated
on stamp
 Detonated 8:45 am.​
 Exploded at rear of packed church,
congregation absorbed blast, front of
congregation = fewer casualties. ​
 @ least 54 KIA.
 St. Sebastian’s Church, Negombo​
 Bomber walked across
courtyard into middle of church
unhindered, stopped to gingerly​
touch a little girl.
 Detonated 8:47 am.
 ​Exploded at middle entrance on left
side of congregation.
 105 KIA.​
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

13.
13
The church attacks
 Zion Church Batticaloa​
 Bomber was suspected of casing the
site the day before.​
 8:30 am (21 Apr) inquires about mass
at St. Mary’s Cathedral, missed
service, which was held earlier
than usual & was refused entry.​
 CCTV shows him returning to mosque
after seemingly casing another venue,
Zion Church 400m away.​
 9:30 am leaves Jami us
Salam Jumma Masjid, walks to Zion
Church, refused entry into main hall.
 9:38-9:45 am detonates in church
courtyard. ​
 26 KIA, 100 WIA.
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

14.
 The Kingsbury Hotel
 Checked in w/bomb at 7:30 pm.
 Got in line, Harbour Court’s
breakfast buffet.
 Detonated 8:47am.
 Casualties UNK, @ least 8 KIA.
 Damage ($361,037.50 USD worth).
 Hotel remained open.
 The Shangri La
 Checked in w/bombs, used real name…
 …possibly a lure tactic – raid on house.
 2 bombers in lift, joking w/each other.
 Entered the Table One’s breakfast buffet,
reportedly from different sides.
 Detonated 8:51 am.
 33 KIA.
 Reopened 12 Jun (ahead of 19 Jun schedule).
The hotel attacks
14
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

15.
 New Tropical Inn
 Original targ, Taj Samudra’s Ports of Call
breakfast buffet.
 Checked in 4:53 pm, w/roller luggage.
 Left, returned 7:07 am 21 April w/+ roller
luggage.
 8:50 am, Ports of Call, failed detonation.
 Left Taj, checked into New Tropical Inn, 9:30
am.
 Left 9:45 am, returned, & detonated 1:30 pm.
 2 KIA.
 Nearly leveled building.
 Cinnamon Grand
 Checked in using fake name.
 Entered Taprobane’s breakfast
buffet.
 Appeared unsure, stepped back &
forth, hesitated.
 Detonated 9:12 am.
 20 KIA.
 Hotel remained open.
The hotel attacks
15
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

16.
 21 April 2019, Raid on bomber’s condo
 Wife met police @ the door.
 Ran to top of the stairs, detonated suicide bomb.
 Killed self, unborn child, 3 children, 3 police.
 Rilwan, on video, said the wives would detonate & meet
their husbands in heaven.
 21 April 2019, pipe bomb, airport access road
 Air Force patrol discovered 6-ft pipe bomb, EOD secured.
 50 kgs (110 lbs) of explosives.
 400-meter (437-yard) blast radius.
 22 April 2019, vehicle bomb
 Outside St. Anthony’s shrine, failed to explode.
 Timed to detonate (washing machine timer) 90 min later.
 Targeted 1st
responders.
 Exploded as EOD tried to defuse it.
Three more bombs
16
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

17.
 Nationwide emergency, curfew, increased
security, arrest powers widened.
 Social media restricted.
 Ban on burka/all Muslim face veils.
 Weeks of raids/search ops.
 Over 500 arrested: 102 in police-TID custody
for links to the attack.
 Scores of weapons caches discovered (not
all IJ).
 Gov scandal, scores of resignations:
 Police chief, defense minister, intelligence
chief.
 9+ Muslim ministers.
Aftermath
17
 FBI, India’s NIA, others assist.
 Saudi deported 5 SL citizens linked to
attacks.
 …incl Mohammad Milhan: NTJ
 Connected to 2018 execution of 2 police.
 Deportations.
 600 w/links to IJ.
 …incl 200 clerics…
 …expired visas, India, Pakistan,
Bangladesh, Maldives.
 Religious violence – Buddhists vs
Muslims.
 …in places like the NW province,
hundreds of Muslims left homeless.
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

18.
Aftermath
 Terror camp discovered (2d one)
 4 May 2019, Kattankudy, run by NTJ.
 10-15-acres.
 Owned by Mohammed Milhan.
 Cover was chicken farm.
 100 + militants trained there from India,
Pakistan, & SL.
 Pipe bomb materials found.
 Evidence of firearms training.
 Bomb factory & Hashim’s family’s final stand
 26 April 2019, 7:30 pm, in Sainthamaruthu.
 Intel from police & Muslims.
 Bomb factory, planning HQ.
 Firefight w/STF, 3 suicide bombs, killed 9 fam members,
incl 6 children.
 Hashim’s father, Mohamed Hashim.
 2 brothers, Zainee & Rilwan.
 1 civ KIA & 2 WIA (Hashim’s wife/daughter).
 16 KIA.
 150 sticks of explosives, drone, ISIS flag. Zainee, younger brother of Hashim, video: (holding an AK-47
w/child), “The killings won’t stop here, even if we are destroyed...you
can be sure you will meet more of these attacks in future.”
18
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

19.
Conclusions
19
 Overall Analysis
 ISIS’ 1st
major post-caliphate op.
 Sophisticated, multi-stage bombings.
 Highly successful, both tactically &
strategically.
 258 KIA, 500 WIA, 758 total, shock/horror,
tourism-gov impacted (47 foreigners IKIA).
 ISIS = force to be reckoned with.
 Leaderless revolution works.
 Tactical-operational analysis
 Personnel = dedicated, true believers,
methodical, relentless.
 Intelligence = excellent.
 Operational expertise = professional.
 Logistics = highly resourceful.
 High organizational prowess, well-
coordinated.
 Excellent synchronization (@ least
12 operatives, 11 targs, 9 good
hits, & 2 good lure/follow-ons).
 Studied/understood flow of
LE/security op cycle; attacked it.
 Demonstrated denial & deception.
Tourism = 4.9 % of Sri Lanka’s GDP,
$4.4 bn, dropped 70%.
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

20.
Conclusions
20
 Indicators & warnings
 Intelligence failures.
 PC hysteria & gov infighting blinded gov, =
people killed.
 Hotel security = negligence; had access to
critical data points clearly indicated viable
threats.
 Target selection
 Softest targets possible – churches & hotels.
 IJ/ISIS/AQ priority targs.
 “Targets w/in targets” = Sunday buffet lines
& Easter congregations.
 1) IJ vs. Buddhist strife.
 2) A major IJ terror camp found
with over 200 lbs of explosives,
plus detonators.
 3) Issues 1-2 = SOP for IJ war
escalation, totality of
circumstances = should have
increased security.
 Failure to heed.
 Failure to disseminate.
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

21.
Conclusions
21
 Assessment
 ISIS will act on its words, per usual.
 Seeds of religious war sewn in SL.
 SL operational model = replicate
when/where possible.
 Leaderless revolution will continue.
 Distributed ops will increase (at least, that is
the intention).
 Strikes against non-traditional targs & across
dispersed “ISIS provinces.”
 Govs cannot combat ISIS alone –
corporations must increase intel & phys
security.
 Tourism/hotels increasingly at risk.
 Churches/Christianity, other religions,
Muslim minorities increasingly at risk.
 War for the sake of war. (end
goal of “victory” not necessary)
 Attrition. (high casualty counts)
 Revenge. (new, angry motivation)
 Tawaghits/taghut. (govs ruled by
man’s law, particularly
democracies, which are haram)
 Americans & EU citizens. (always
targets in the past, now they are
doubling down)
 More to come. (official IJ warning
has been issued)
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

22.
Question
s?
22
Proprietary, Jeff M. Moore, PhD, muiranalytics.com, Copyright©Muir Analytics, LLC, 2019, jmoore@muiranalytics.com, 1-833-DATA-444 (833-328-2444)

23.
Video
Read the transcript
. Watch thevideo .